3 ms·
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724485(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms7...
by dblohm7 9y ago
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724485(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms7...
- naasking 9y agoThanks. None of the creator functions take the handles needed, which is contrary to capability security. This leaves the system vulnerable to DoS attacks at the very least.
- dblohm7 9y agoCreation of those objects is also implicit on checking the current thread's access token and the current process's job (if present). So I think it has the same concerns that you outlined in an earlier comment about Fuchsia's creator functions.
- naasking 9y agoInteresting that the fuchsia kernel design seems to mimic the NT kernel in this regard...
- naasking 9y agoThere are also other issues I just remembered. Handles in a capability OS have no access control applied to them, ie. if you hold a handle, then you have permission to invoke operations on that handle. Attenuating authority involves deriving a new handle from an existing one with reduced rights, then passing that around. I believe the NT kernel still checks permissions against ACLs for handles. This violates capability security, but you can build a capability OS on top of ACLs: http://www.webstart.com/jed/papers/Managing-Domains/ http://www.webstart.com/jed/papers/Managing-Domains/